How BEC attacks work

  • Account compromise: the attacker logs in to a real mailbox, often with leaked credentials, reads ongoing conversations and replies at the right moment.
  • Impersonation: the attacker sends from a lookalike domain or a spoofed display name that resembles a known contact.
  • Supplier fraud: a fake or compromised supplier asks for future invoices to be paid to new bank details.
  • CEO fraud: a message apparently from a senior leader asks for an urgent, confidential transfer.

Why BEC is so costly

BEC messages often contain no links or attachments, just a believable request in the right context, so email security tools have little to detect. Once a payment is sent to a mule account it is often moved on within hours. In the UK this type of fraud is commonly known as mandate fraud or authorised push payment fraud.

How to prevent BEC

  1. Verify any change of bank details by calling a known number, never one in the email.
  2. Require two people to approve large or unusual payments.
  3. Enforce multi-factor authentication and watch for suspicious mailbox rules.
  4. Monitor for lookalike domains of your own brand and your key suppliers.
  5. Watch for executives' and finance staff's credentials appearing in leaks.

How DarkInvader helps

DarkInvader reduces the inputs BEC depends on. It detects lookalike domains of your brand, alerts on leaked credentials for finance staff and executives through Leaked Credentials and VIP Monitoring, and takes down impersonating sites.

Explore Brand Monitoring

Frequently asked questions

Is business email compromise the same as phishing?

BEC is a type of fraud that often uses phishing techniques, but it focuses on impersonating a trusted contact to get money or data, usually without malware or malicious links.

What should I do if we paid a BEC fraudster?

Contact your bank immediately to try to recall the payment, report it to Action Fraud in the UK, preserve the emails, and check the affected mailbox for compromise such as forwarding rules or unknown sign-ins.

Can DMARC prevent BEC?

DMARC stops attackers sending email from your exact domain, which blocks one type of BEC. It does not stop lookalike domains or attacks from a genuinely compromised mailbox, which need other controls.

Related terms and reading

Sources